Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

There is no way to rescue tokens accidently sent to RToken contract

lyuboslav

Summary

RToken contract has fn to rescuie accidental sent tokens with rescueToken fn, but no pools use the function, so in practise, the tokens are trapped.

Vulnerability Details

The rescueToken function in RToken contract is designed to rescue mistakenly sent ERC20 tokens.

/**
* @notice Rescue tokens mistakenly sent to this contract
* @dev Only callable by the Reserve Pool. Cannot rescue the main asset.
* @param tokenAddress The address of the ERC20 token
* @param recipient The address to send the rescued tokens to
* @param amount The amount of tokens to rescue
*/
function rescueToken(address tokenAddress, address recipient, uint256 amount) external onlyReservePool {
if (recipient == address(0)) revert InvalidAddress();
if (tokenAddress == _assetAddress) revert CannotRescueMainAsset();
IERC20(tokenAddress).safeTransfer(recipient, amount);
}

The function has modifier onlyReservePool, which restricts the function caller to be the "_reservePool".

modifier onlyReservePool() {
if (msg.sender != _reservePool) revert OnlyReservePool();
_;
}

If we look at the other parts of the code, we can see that its frequently used with ILendingPool interface.

function balanceOf(address account) public view override(ERC20, IERC20) returns (uint256) {
uint256 scaledBalance = super.balanceOf(account);
return scaledBalance.rayMul(ILendingPool(_reservePool).getNormalizedIncome());
}

Its safe to assume that _reservePool is the lendingPool. If we look into the lendingPool we will not find any function that calls the rescue tokens.

Impact

Accidently sent tokens are frozen in the RToken contract

Tools Used

Manual review

Recommendations

Implement fn in the lending pool that calls the rescue fn in the RToken contract

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::rescueToken() can never be called

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!